Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 68
Country Source Text or translation (excerpts; notes are given in italics)
Dubai
International
Financial
Centre (DIFC,
a selflegislating
free
financial zone)
DIFC Data Protection
Law 2007, Law no. 1
of 2007
(applicable only to the
Dubai International
Financial Center)
Article 11 - Transfers out of the DIFC - Adequate Level of Protection
(1) A transfer of Personal Data to a Recipient located in a jurisdiction
outside the DIFC may take place only if:
(a) an adequate level of protection for that Personal Data is ensured by
laws and regulations that are applicable to the Recipient, as set out in
Article 11 (2); or
(b) in accordance with Article 12.
(2) For the purposes of Article 11(1), a jurisdiction has an adequate level
of protection for that Personal Data if that jurisdiction is listed as an
acceptable jurisdiction under the Regulations or with the written approval
of the Commissioner of Data Protection.
Article 12 - Transfers out of the DIFC in the Absence of an Adequate
Level of Protection
(1) A transfer or a set of transfers of Personal Data to a Recipient which
is not subject to laws and regulations which ensure an adequate level of
protection within the meaning of Article 11 may take place on condition
that:
(a) the Commissioner of Data Protection or his delegate has granted a
permit or written authorisation for the transfer or the set of transfers and
the Data Controller applies adequate safeguards with respect to the
protection of this Personal Data;
(b) the Data Subject has given his written consent to the proposed
transfer;
(c) the transfer is necessary for the performance of a contract between the
Data Subject and the Data Controller or the implementation of precontractual
measures taken in response to the Data Subject's request;
(d) the transfer is necessary for the conclusion or performance of a
contract concluded in the interest of the Data Subject between the Data
Controller and a Third Party;
(e) the transfer is necessary or legally required on grounds important in
the interests of the DIFC, or for the establishment, exercise or defence of
legal claims;
(f) the transfer is necessary in order to protect the vital interests of the
Data.
(g) the transfer is made from a register which according to laws or
regulations is intended to provide information to the public and which is
open to consultation either by the public in general or by any person who
can demonstrate legitimate interest, to the extent that the conditions laid
down in law for consultation are fulfilled in the particular case;
(h) the transfer is necessary for compliance with any legal obligation to
which the Data Controller is subject or the transfer is made at the request
of a regulator, police or other government agency;
(i) the transfer is necessary to uphold the legitimate interests of the Data
Controller recognised in the international financial markets, provided that
such is pursued in accordance with international financial standards and
except where such interests are overridden by legitimate interests of the
Data Subject relating to the Data Subject's particular situation; or
(j) the transfer is necessary to comply with any regulatory requirements,
auditing, accounting, anti-money laundering or counter terrorist financing
obligations or the prevention or detection of any crime that apply to a
Data Controller.